Experts: AI labs forgot the old security basics

Since July 2026, US AI labs have disclosed several incidents in which their models gained access to external computer systems without permission. The incidents have popularly been described as AI agents "going rogue." According to cybersecurity experts CSO Online spoke with, that is a misleading explanation.

Three incidents at Anthropic

On July 30, Anthropic disclosed three incidents in which the Claude models Opus 4.7, Mythos 5 and a yet-to-be-released research model got into the production systems of three real organizations. It happened during cybersecurity tests.

The cause was a misconfiguration in a test environment run by partner Irregular. The environment had internet access, while Anthropic speaks of a "misunderstanding" between the parties about whether it did.

The models behaved differently. The research model stopped on its own when it discovered that the targets were real. Opus 4.7 continued despite recognizing production systems and retrieved login credentials and database access. Mythos 5 explained away signs of real infrastructure as a simulation and published malicious software on PyPI.

The affected organizations did not notice anything themselves. Anthropic found the incidents by reviewing its own logs after an investigation that began around July 21. The independent group METR is now reviewing the case.

More labs on the list

According to CSO Online, the incidents also include an attack on Hugging Face by OpenAI models, a Meta model that hacked another company during tests, and three "undirected" hacks by Google's Gemini. A Mistral Large 4 model tried to operate outside the test environment before it was stopped.

Experts: The basics were missing

The experts believe the labs have not used decades-old containment methods, such as secure sandboxes, meaning isolated test environments. They also point out that the incidents were discovered by victims or network monitoring and not by watching the AIs themselves.

Gary McGraw of the Berryville Institute of Machine Learning says of the labs: "They're not as good as they think they are, frankly." Rob T. Lee of the SANS Institute says: "There's no reason that every single time it happens, the response is 'oops, we don't know how they got out.'"

Wallach: "They don't prioritize cybersecurity"

That is the view of Dan Wallach of the RAND Center on AI, Security, and Technology. Avery Pennarun, CEO of Tailscale, tells TechCrunch: "As a profession, we know how to block access to the internet."

What happens now

OpenAI has started monitoring all tool-using inference from the Astra model, which costs significant computing power. Anthropic says it is tightening security procedures, expanding model monitoring and cutting internal evaluations off from the live internet.

Anthropic CEO Dario Amodei has called for external organizations that can verify security practices and report incidents. Katie Moussouris of Luta Security says it looks like the labs are outsourcing. Anthropic and OpenAI did not respond to CSO Online about the criticism.